KYC and Identity Checks: What to Expect When You Gamble Online

Few things frustrate online gamblers more than a request for a passport scan or three months of bank statements, particularly when it arrives just as they try to withdraw. Understanding why these checks exist, when they happen and what is reasonable makes the process less stressful and helps you spot when something is not right.

What KYC means

Know your customer (KYC) is the process by which a regulated business confirms who its customers are. In gambling it serves several legal purposes:

• Age verification: preventing under-18s (or under-21s, in some markets) from gambling. See age verification requirements.
• Identity verification: confirming you are who you say you are, preventing fraud and multiple accounts.
• Self-exclusion enforcement: matching you against national and operator exclusion lists.
• Anti-money laundering (AML): understanding where money comes from and spotting suspicious activity.
• Safer gambling: identifying signs that spending may be harmful or unaffordable.

When checks happen

At registration

In Great Britain, since May 2019, licensed online operators must verify a customer’s name, address and date of birth before the customer can deposit or gamble, including on free-to-play demo versions of games. Many other regulated markets require verification at or shortly after registration, often with limits on how much can be deposited before it is complete.

Most checks happen electronically and invisibly: the operator compares your details with databases such as electoral rolls and credit reference records. If that fails, you will be asked for documents.

Ongoing and triggered checks

Checks do not stop after sign-up. Operators may ask for more information when:

• Deposits or losses reach thresholds set by law or by the operator’s risk policy.
• Spending patterns change sharply, such as rapid deposits or late-night sessions.
• You change payment methods, or use a card or account in someone else’s name.
• AML rules require customer due diligence at certain transaction levels.

At withdrawal

Withdrawal is a common trigger because it is the point at which money leaves the system. If you were fully verified at registration, a withdrawal should rarely bring new demands, although source-of-funds checks can still apply to large amounts.

Documents you may be asked for

Purpose	Typical documents
Identity and age	Passport, driving licence or national ID card; sometimes a selfie or liveness check
Address	Recent utility bill, bank statement or council tax bill
Payment ownership	Photo of card (middle digits hidden), e-wallet screenshot, bank statement showing your name
Source of funds	Payslips, bank statements, tax returns, evidence of savings or inheritance
Source of wealth (high spend)	Evidence of how overall wealth was accumulated

When photographing a payment card, operators commonly ask you to hide the middle digits and the security code on the back. You should never be asked to send a full card number with the CVV.

Affordability and financial risk checks

Separate from AML, many regulators now expect operators to consider whether gambling spend is affordable. Approaches differ widely and are evolving: some countries use deposit or loss caps, others rely on risk-based checks triggered by spending levels. Our article on affordability and financial risk checks explains the current position by country. These checks can feel intrusive, but they exist because gambling harm is often closely tied to unaffordable losses.

Protecting your data

You are handing over sensitive documents, so take care:

• Upload only through the operator’s secure account area or official app, not by replying to an email or message you did not expect.
• Beware of phishing: fake “verification” emails and texts are a known fraud tactic. Log in directly rather than following links.
• Check the privacy notice to see how long documents are kept. AML law typically requires records to be retained for several years after the relationship ends.
• Use your data rights. Under the UK GDPR and EU GDPR you can ask what data is held about you through a subject access request.
• Never send documents to an unlicensed site. Your ID could be misused, and there may be no regulator to complain to; see spotting unlicensed operators.

What is reasonable, and what is not

Reasonable:

• Requests that match the operator’s published verification policy.
• Proportionate requests linked to spending levels or legal thresholds.
• A clear explanation of what is needed and why, within legal limits (operators cannot always tell you if a check relates to suspected money laundering).

Warning signs:

• Repeated new document demands, each arriving only after the last was supplied, particularly when a large win is pending.
• Requests for fees to “unlock” verification or withdrawals. This is a classic scam.
• Verification requirements that never appeared in the terms when you signed up.

If you believe checks are being used to delay a legitimate withdrawal, raise a formal complaint and, if unresolved, escalate to independent dispute resolution, as covered in withdrawals and player fund protection.

Practical tips

1. Verify fully as soon as you open an account, before any withdrawal is pending.
2. Use payment methods in your own name.
3. Keep your details up to date, especially your address.
4. Keep copies of what you sent and when.
5. If checks reveal that spending has crept up, treat that as useful information, not just a hurdle. Setting limits early is easier than explaining large deposits later.